Vulnerability Details CVE-2017-16896
A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 56.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://discourse.tt-rss.org/t/sql-injection-in-forgotpass-fixed/669
- https://git.tt-rss.org/git/tt-rss/commit/2352c320c2ed34ec7df1ad22f0c55a1b26489815
- https://discourse.tt-rss.org/t/sql-injection-in-forgotpass-fixed/669
- https://git.tt-rss.org/git/tt-rss/commit/2352c320c2ed34ec7df1ad22f0c55a1b26489815
Products affected by CVE-2017-16896
-
cpe:2.3:a:tt-rss:tiny_tiny_rss:17.4